i 


GAO 

Accountability  *  Integrity  *  Reliability 


United  States  Government  Accountability  Office 
Washington,  DC  20548 


May  21,  2007 

The  Honorable  Solomon  P.  Ortiz 
Chairman 

The  Honorable  Jo  Ann  Davis 
Ranking  Member 
Subcommittee  on  Readiness 
Committee  on  Armed  Services 
House  of  Representatives 

Subject:  Defense  Infrastructure:  Full  Costs  and  Security  Implications  of  Cheyenne 
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The  Department  of  Defense  (DOD)  built  the  Cheyenne  Mountain  Operations  Center1 
located  near  Colorado  Springs,  Colorado,  in  the  early  1960s  to  withstand  a 
multimegaton-yield-weapon  strike  and  to  provide  protection  against  chemical  and 
biological  warfare.  The  mission  of  the  Cheyenne  Mountain  Directorate  is  to  monitor, 
process,  and  interpret  air,  missile,  and  space  events  that  could  threaten  North 
America  or  have  operational  effects  on  U.S.  forces  or  capabilities.  This  mission  is 
conducted  at  five  major  centers — the  Command  Center,  Air  Warning,  Missile 
Correlation,  Operations  Intelligence  Watch,  and  Space  Control — all  currently  located 
within  Cheyenne  Mountain.  Elements  of  United  States  Strategic  Command 
(USSTRATCOM)"  and  Air  Force  Space  Command3  are  also  located  in  Cheyenne 
Mountain.  The  Air  Force’s  modernization  of  the  attack  warning  systems  within 
Cheyenne  Mountain  will  cost  more  than  $700  million  from  fiscal  years  2000  through 
2006.4 

Peterson  Air  Force  Base,  also  located  in  Colorado  Springs,  Colorado,  is  the 
headquarters  of  United  States  Northern  Command  (USNORTHCOM)  and  the  North 
American  Aerospace  Defense  Command  (NORAD).  NORAD  is  a  binational  U.S.  and 
Canadian  organization  staffed  by  both  U.S.  and  Canadian  personnel.  The  Commander 
of  USNORTHCOM  is  also  the  Commander  of  NORAD  and  he  currently  has  command 


’The  Cheyenne  Mountain  Operations  Center  is  now  known  as  the  Cheyenne  Mountain  Directorate.  It 
is  one  of  several  tenants  that  compose  the  Cheyenne  Mountain  Air  Force  Station  near  Colorado 
Springs,  Colorado. 

2USSTRATCOM  conducts  the  missile  warning  mission  for  North  America. 

'Air  Force  Space  Command  conducts  the  space  control  mission  for  North  America. 

4GAO,  Defense  Acquisitions:  Further  Management  and  Oversight  Changes  Needed  for  Efforts  to 
Modernize  Cheyenne  Mountain  Attack  Warning  Systems ,  GAO-06-666  (Washington,  D.C.:  July  6, 
2006). 
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of  two  fixed  command  centers.5  The  NORAD  and  USNORTHCOM  Command  Center 
is  located  at  Peterson  Air  Force  Base  and  conducts  air,  land,  maritime,  and  homeland 
defense  operations,  as  well  as  defense  support  of  civil  authorities.  The  command 
center  in  Cheyenne  Mountain  is  a  NORAD  and  USNORTHCOM  command  center  that 
provides  air,  missile,  and  space  warning,  characterization,  and  assessment  for 
NORAD,  USNORTHCOM,  and  USSTRATCOM  as  well  as  command  and  control  for  the 
ground-based  mid-course  missile  defense  program. 

DOD  officials  have  stated  that  they  no  longer  need  to  continue  operating  in  this 
hardened  facility  considering  that  the  threat  of  an  intercontinental  ballistic  missile 
strike  in  today’s  environment  is  low.  In  July  2006,  the  former  Commander  of  NORAD 
and  USNORTHCOM5  announced  plans  to  move  certain  functions  from  Cheyenne 
Mountain  and  create  an  integrated  command  center  at  Peterson  Air  Force  Base, 
which  he  projected  at  that  time  would  save  between  $150  million  and  $200  million  per 
year.  Additionally,  USSTRATCOM  announced  plans  to  relocate  its  missile  warning 
mission  from  Cheyenne  Mountain  to  Schriever  Air  Force  Base,  Colorado,  and  Air 
Force  Space  Command  is  in  the  process  of  moving  the  Space  Control  Center  from 
Cheyenne  Mountain  to  Vandenberg  Air  Force  Base,  California.  NORAD  and 
USNORTHCOM  officials  told  us  that  after  these  functions  have  been  moved, 

Cheyenne  Mountain  will  be  used  as  an  alternate  command  center,  a  continuity  of 
operations  relocation  facility,  and  a  training  center. 

You  asked  us  to  determine  (1)  the  estimated  costs,  savings,  and  benefits  associated 
with  moving  functions  from  Cheyenne  Mountain  to  other  locations;  and  (2)  how  DOD 
evaluated  the  security  implications  associated  with  moving  the  functions,  and  what 
these  implications  are.  On  March  13,  2007,  we  provided  your  office  with  a  briefing  on 
our  preliminary  observations  regarding  the  proposed  relocation.  This  report 
summarizes  the  results  of  that  briefing  and  provides  updated  information  as  a  result 
of  additional  work  we  have  performed  since  that  time. 

To  determine  the  costs,  savings,  and  benefits  associated  with  the  proposed  relocation 
of  functions  from  Cheyenne  Mountain,  we  reviewed  and  analyzed  reports  and  studies 
conducted  by  NORAD  and  USNORTHCOM,  Sandia  National  Laboratories'  and 
Lockheed  Martin8  on  the  costs  and  implications  of  relocating  functions  from 
Cheyenne  Mountain,  and  we  interviewed  NORAD  and  USNORTHCOM  officials  to 
identify  the  expected  benefits  of  the  relocation.  We  also  interviewed  USSTRATCOM 
and  Air  Force  Space  Command  officials  to  identify  the  costs,  savings,  and  benefits 
associated  with  the  relocation  of  their  functions  from  Cheyenne  Mountain.  We  also 
interviewed  USNORTHCOM  and  Air  Force  budget  analysts  to  determine  how  the  cost 
estimates  were  developed  and  validated.  Based  on  these  interviews,  we  believe  that 
the  cost  data  are  sufficiently  reliable  for  our  purposes.  To  determine  the  security 
implications  of  the  relocation  and  how  they  were  evaluated  by  DOD,  we  reviewed 


“The  Commander  also  has  a  mobile  consolidated  command  center  based  at  F.E.  Warren  Air  Force 
Base,  Wyoming. 

6The  new  NORAD  and  USNORTHCOM  Commander  was  sworn  in  on  March  23,  2007. 

7Sandia  National  Laboratories,  a  federally  funded  research  center,  was  tasked  to  study  the  security 
implications  of  four  options  for  moving  missions  from  Cheyenne  Mountain  to  Peterson  Air  Force  Base. 
sLockheed  Martin  conducted  this  study  under  contract  with  the  Electronic  Systems  Center.  The 
Electronic  Systems  Center,  a  component  of  Air  Force  Materiel  Command,  manages  the  development 
and  acquisition  of  electronic  command  and  control  systems  for  the  Air  Force. 


Page  2 


GAO-07-803R  Defense  Infrastructure 


vulnerability  assessments  and  risk  assessments  conducted  by  USNORTHCOM  and  a 
security  analysis  conducted  by  Sandia  National  Laboratories  for  the  proposed 
relocation  of  NORAD  and  USNORTHCOM  functions,  and  we  discussed  these 
assessments  and  others  that  are  ongoing  and  their  potential  effect  on  operations  with 
NORAD,  USNORTHCOM,  and  Air  Force  Space  Command  officials,  and  the  Joint 
Staff.  We  conducted  our  review  from  January  2007  through  May  2007  in  accordance 
with  generally  accepted  government  auditing  standards. 

Summary 

NORAD  and  USNORTHCOM  could  not  provide  documentation  to  support  the  $150 
million  to  $200  million  savings  projected  by  the  former  Commander  from  moving 
functions  from  Cheyenne  Mountain  to  Peterson  Air  Force  Base.  As  of  April  2007, 
NORAD  and  USNORTHCOM  officials  have  identified  at  least  $41.7  million  in  onetime 
costs  and  $5.5  million  in  recurring  costs  related  to  the  move;  however,  the  full  costs 
will  not  be  determined  until  the  completion  of  ongoing  security  assessments. 

NORAD  and  USNORTHCOM  officials  stated  that  they  expect  increased  unity  of  effort 
and  operational  efficiencies  as  a  result  of  the  integration.  Although  there  is  no 
requirement  for  it,  NORAD  and  USNORTHCOM  have  not  done  an  analysis  of  the 
operational  effects — both  positive  and  negative — of  the  move.  In  fiscal  years  2006 
and  2007,  NORAD  and  USNORTHCOM  allocated  $26.7  million  for  conducting  studies, 
purchasing  needed  equipment  related  to  the  relocation,  and  renovating  the  command 
center  at  Peterson  Air  Force  Base.  Renovation  of  the  command  center  is  scheduled 
to  begin  in  June  2007  and  be  completed  in  December  2007.  NORAD  and 
USNORTHCOM  officials  are  planning  to  allocate  $15  million  in  fiscal  year  2008  to 
purchase  the  remaining  equipment  for  the  integrated  command  center  and  program 
management  support.  Additional  costs  will  likely  be  incurred  based  on  the  results  of 
ongoing  studies  related  to  security  requirements.  Moreover,  Air  Force  Space 
Command  officials  estimate  that  it  will  cost  about  $13  million  to  move  their  functions 
to  Vandenberg  Air  Force  Base,  but  USSTRATCOM  has  not  yet  developed  a  cost 
estimate  for  relocating  their  functions  from  Cheyenne  Mountain  to  Schriever  Air 
Force  Base. 

The  Commander  of  NORAD  and  USNORTHCOM  decided  to  accept  the  risk  of 
integrating  the  command  centers  based  on  initial  risk  and  vulnerability  assessments, 
but  the  full  security  implications  will  not  be  known  until  ongoing  security 
assessments  are  completed  and  a  protection  level  is  designated  for  the  integrated 
command  center.9  While  initial  security  assessments  provided  information  on 
vulnerabilities  based  on  current  and  projected  threats,  further  assessments  were 
needed  to  evaluate  the  cost  of  hardening  computer  terminals  against  electromagnetic 
pulse  and  to  evaluate  the  physical  security  requirements  of  protecting  the  integrated 
command  center.  Before  the  Air  Force  can  designate  a  protection  level  for  the  new 
command  center,  the  Commander  of  NORAD  and  USNORTHCOM  must  decide 
whether  key  computer  terminals  will  move  to  Peterson  Air  Force  Base  or  remain  in 
Cheyenne  Mountain.  According  to  NORAD  and  USNORTHCOM  officials,  this 
decision  will  be  made  after  a  study  on  electromagnetic  pulse  hardening  requirements 


9  The  Air  Force  must  designate  a  protection  level  for  the  functions  moving  into  the  integrated 
command  center  pursuant  to  Air  Force  Instruction  31-101,  The  Air  Force  Installation  Security 
Program,  (Mar.  1,  2003). 
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is  completed  in  late  May  2007.  Moreover,  a  System  Effectiveness  Assessment, 
scheduled  for  completion  in  September  2007,  will  provide  information  on  the  physical 
security  needed  to  protect  the  Cheyenne  Mountain  systems  that  may  be  replicated  at 
Peterson  Air  Force  Base.  According  to  NORAD  and  USNORTHCOM  officials,  it  could 
take  up  to  24  months  to  obtain  the  resources  needed  to  meet  the  designated 
protection  level  requirements.  If  requirements  for  the  designated  protection  level 
cannot  be  met  because  of  funding  and  resource  constraints,  waivers  will  be  needed  to 
begin  operations  or  specific  systems  may  remain  in  Cheyenne  Mountain. 

We  believe  Congress  should  consider  restricting  DOD’s  authority  to  use  funds  to 
renovate  all  proposed  locations  to  accept  functions  designated  to  move  out  of 
Cheyenne  Mountain  until  such  time  as  all  security  analyses  are  complete,  the  full 
costs  of  the  move  are  determined,  and  DOD  provides  Congress  with  an  analysis  of  the 
operational  effects  of  the  proposed  realignments. 

Background 

Currently,  there  is  a  NORAD  and  USNORTHCOM  command  center  located  at 
Peterson  Air  Force  Base  and  a  NORAD  and  USNORTHCOM  command  center  located 
inside  Cheyenne  Mountain.  Command  staff  are  presently  located  in  each  of  the 
separate  command  centers.  Cheyenne  Mountain’s  mission  is  to  monitor,  process,  and 
interpret  air,  missile,  and  space  events  that  could  threaten  North  America  or  have 
operational  effects  on  U.S.  forces  or  capabilities,  using  air,  ground,  and  space-based 
sensors  that  link  to  the  complex’s  computer  systems  located  more  than  2,000  feet 
under  ground.  This  mission  is  conducted  at  five  major  centers  within  Cheyenne 
Mountain — the  Command  Center,  Air  Warning,  Missile  Correlation,  Operations 
Intelligence  Watch,  and  Space  Control — by  approximately  658  people,  including 
support  personnel.  These  personnel  belong  to  NORAD,  USNORTHCOM, 
USSTRATCOM,  and  Air  Force  Space  Command,  as  shown  in  table  1. 
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Table  1:  Realignment  of  U.S.  Military  and  Civilian  Personnel  in  Cheyenne  Mountain 


Command 

Number  of  personnel 

Positions 

eliminated 

Currently  in 
mountain 

Remaining  in 
mountain 

HSI 

Moving  to  other 

Air  Force  Bases 

NORAD3 

112 

TBD 

TBD 

0 

0 

Northern  Command 
(USNORTHCOM)11 

42 

24 

18 

0 

0 

Strategic  Command 
(USSTRATCOM)3 

81 

TBD 

17 

TBD 

TBD 

Air  Force  Space 
Command 

160 

0 

12 

138 

10 

Air  Force  Space 
Command  support 
personnel 

263 

263 

0 

0 

0 

Totald 

658 

TBD 

TBD 

TBD 

TBD 

Source:  USNORTHCOM,  NORAD,  USSTRATCOM,  Air  Force,  and  GAO  calculation. 

Notes:  TBD  =  to  be  determined. 

aNORAD  has  not  yet  determined  the  number  of  personnel  that  are  remaining  in  the  mountain  and  those  moving  to  Peterson 
Air  Force  Base. 

bUSNORTFICOM  positions  remaining  in  Cheyenne  Mountain  are  for  Nuclear  Command  and  Control. 

cNORAD  and  USNORTFICOM  have  formally  requested  that  USSTRATCOM  transfer  17  positions  to  Peterson  to  support 
NORAD’s  correlation  of  potential  missile  and  space  threats  to  North  America. 

dContractor  personnel  are  not  included  in  the  table.  There  are  also  28  Canadian  personnel  currently  working  in  Cheyenne 
Mountain. 

No  final  decisions  have  been  made  as  to  how  many  personnel  will  remain  in  the 
mountain,  move  to  Peterson  Air  Force  Base,  or  move  to  other  locations.  There  are 
also  approximately  500  contractors  in  Cheyenne  Mountain  providing  support  to  each 
of  the  major  centers.  It  has  not  been  determined  how  many  of  these  contractors  will 
be  retained  in  the  mountain  after  the  relocation. 

During  a  series  of  major  exercises  conducted  in  2005,  the  Commander  of  NORAD  and 
USNORTHCOM  attempted  to  direct  planning,  operations,  and  command  and  control 
from  two  separate  command  centers.  In  the  course  of  the  exercises,  the  Commander 
identified  shortcomings  in  unity  of  effort  due  to  the  geographic  separation  of  the 
command  centers  and  negatively  affecting  critical,  time-sensitive  decisions.  As  a 
result,  in  late  2005,  the  Commander  of  NORAD  and  USNORTHCOM  directed  a  senior 
command  official  to  analyze  options  for  correcting  these  shortcomings  and  to 
determine  the  limitations  and  costs  of  duplicating  Cheyenne  Mountain  capabilities 
within  the  NORAD  and  USNORTHCOM  Command  Center  at  Peterson  Air  Force  Base. 
This  analysis  concluded  that  it  would  be  cost-prohibitive  to  duplicate  Cheyenne 
Mountain  capabilities  at  Peterson  Air  Force  Base.  The  Commander  then  tasked  the 
official  to  analyze  options  to  “replicate,”  rather  than  duplicate,  capabilities  of  the  two 
command  centers  in  a  single  location.10  This  analysis  considered  the  following  four 
options:  a  single  command  center  at  Peterson,  a  single  command  center  at  Cheyenne 


“USNORTHCOM  officials  told  us  that  in  this  context,  replicating  capabilities  means  leaving  computer 
servers,  equipment,  and  infrastructure  in  the  mountain  and  digitally  sending  the  information  to  the 
NORAD  and  USNORTHCOM  Command  Center  at  Peterson.  Duplicating  capabilities  would  involve 
moving  the  servers,  equipment,  and  infrastructure. 
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Mountain,  a  Net-centric  battle  cab,  or  two  separate  command  centers.  The  analysis 
concluded  that  a  single  command  center  at  Peterson  Air  Force  Base  was  the  only 
option  that  provided  the  physical  space  required  and  strengthened  unity  of  effort 
between  the  commands. 

In  February  2006,  the  NORAD  and  USNORTHCOM  Commander  ordered  a  study  to 
determine  how  best  to  establish  a  NORAD  and  USNORTHCOM  Command  Center  at 
Peterson  Air  Force  Base  and  place  the  Cheyenne  Mountain  Directorate  in  “warm 
standby”  status.  The  completed  study11  outlined  a  plan  to  move  the  air  warning, 
missile  correlation,  and  command  center  functions  out  of  Cheyenne  Mountain  but  to 
leave  the  core  computer  systems  there,  from  which  they  would  transmit  their  data  to 
Peterson  Air  Force  Base.  The  Air  Force  must  designate  a  protection  level  for  the 
functions  moving  into  the  integrated  command  center.  The  protection  level  system 
identifies  specific  requirements  for  each  security  level  and  recognizes  that  the  users 
must  accept  varying  degrees  of  risk.  If  resources  are  not  available  to  meet  the 
assigned  protection  level  requirements,  the  Commander  must  request  waivers  from 
the  security  requirements  until  corrections  can  be  made.11  Renovation  of  the 
integrated  command  center  at  Peterson  is  scheduled  to  begin  in  June  2007  and  be 
completed  in  December  2007.  Full  operational  capability  is  planned  for  May  2008. 

Once  the  functions  and  their  associated  personnel  are  moved,  NORAD  and 
USNORTHCOM  officials  told  us  that  they  plan  to  use  Cheyenne  Mountain  as  an 
alternate  command  center  that  could  become  fully  functional  within  approximately  1 
hour,  with  adequate  warning,  if  a  threat  situation  so  dictated.  Additionally,  the 
nuclear  command  and  control  function  for  USNORTHCOM  will  remain  in  the 
mountain  and  the  computer  systems  remaining  will  be  used  to  train  and  certify 
personnel. 

According  to  Joint  Staff  officials,  the  Commander  of  NORAD  and  USNORTHCOM  has 
the  authority  under  Title  10  of  the  United  States  Code  to  make  decisions  affecting  his 
command — including  changing  the  location  of  command  and  control — as  long  as  he 
performs  his  mission  as  described  in  the  Unified  Command  Plan.  Our  review  of  Title 
10  confirms  that  a  commander  of  a  combatant  command,  unless  otherwise  directed 
by  the  President  or  the  Secretary  of  Defense,  has  the  authority  to  perform  such 
command  functions  as  organizing  commands  and  forces  within  that  command  as  he 
considers  necessary  to  carry  out  the  missions  assigned  to  the  command.11  According 
to  USNORTHCOM  officials,  the  Commander  of  NORAD  and  USNORTHCOM 
consulted  with  the  Chairman  of  the  Joint  Chiefs  of  Staff,  the  Secretary  of  Defense, 
and  the  Canadian  Chief  of  Defence  Staff  about  his  plan  to  move  certain  functions  out 
of  Cheyenne  Mountain,  and  he  received  their  verbal  concurrence.  Moreover,  the 
Secretary  of  Defense  stated  in  a  February  2006  memo  to  the  Commander  of  NORAD 
and  USNORTHCOM  that  he  liked  the  Commander’s  approach  to  place  the  mountain 
in  “warm  standby”  and  achieve  a  range  of  cost  savings. 


"U.S.  Northern  Command,  The  NORAD -USNORTHCOM  Transformation  Analysis  Report  (Colorado 
Springs,  Colo.:  July  2006). 

12  Air  Force  Instruction  31-101,  The  Air  Force  Installation  Security  Program,  §6.3.2  (Mar.  1,  2003). 
'TOU.S.C.  §164. 
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USSTRATCOM  and  Air  Force  Space  Command  also  have  functions  in  Cheyenne 
Mountain  that  are  moving  to  other  locations.  USSTRATCOM  has  about  81  people  in 
Cheyenne  Mountain  for  its  missile  warning  mission.  Of  these  81  people,  NORAD  and 
USNORTHCOM  have  formally  requested  that  USSTRATCOM  transfer  17  positions  to 
Peterson  to  provide  some  missile  warning  continuity,  while  an  undetermined  number 
of  personnel  will  move  to  Schriever  Air  Force  Base  in  early  2008.  Likewise,  Air  Force 
Space  Command  officials  told  us  that  they  are  in  the  process  of  moving  about  138 
people  in  the  space  control  center  and  unified  space  vault  to  Vandenberg  Air  Force 
Base.  This  move  is  scheduled  to  be  completed  by  October  2007. 

No  Savings  Result  from  Proposed  Relocation  and 
Estimated  Costs  Have  Not  Been  Fully  Determined 

NORAD  and  USNORTHCOM  could  not  provide  documentation  to  support  the  $150 
million  to  $200  million  savings  projected  by  the  previous  Commander  by  moving 
functions  from  Cheyenne  Mountain  to  Peterson  Air  Force  Base.  As  of  April  2007, 
NORAD  and  USNORTHCOM  officials  have  identified  $41.7  million  in  onetime  and 
$5.5  million  in  recurring  costs  related  to  the  move  so  far;  however,  the  full  costs  will 
not  be  determined  until  the  completion  of  ongoing  security  assessments.  NORAD 
and  USNORTHCOM  officials  stated  that  they  expect  the  relocation  to  result  in 
increased  unity  of  effort  and,  consequently,  improved  operational  efficiencies. 
Although  there  is  no  requirement  for  it,  NORAD  and  USNORTHCOM  have  not  done 
an  analysis  of  the  operational  effects — both  positive  and  negative — of  the  move. 
While  Air  Force  Space  Command  has  identified  approximately  $13  million  in  costs  to 
move  its  mission  to  Vandenberg  Air  Force  Base,  USSTRATCOM  has  not  yet 
determined  the  costs  to  move  its  mission  to  Schriever  Air  Force  Base. 

NORAD  and  USNORTHCOM  Relocation 


NORAD  and  USNORTHCOM  do  not  know  the  full  costs  of  moving  functions  from 
Cheyenne  Mountain  to  Peterson  Air  Force  Base  because  two  security  assessments 
that  will  determine  the  recommended  security  upgrades  are  still  underway.  As  of 
April  2007,  NORAD  and  USNORTHCOM  have  identified  about  $41.7  million  in 
onetime  costs  needed  to  integrate  the  two  command  centers  at  Peterson  Air  Force 
Base,  comprising 

•  $8. 1  million  in  fiscal  year  2006  for  various  studies  related  to  the  relocation  and 
for  purchasing  equipment  needed  to  replicate  some  computer  systems; 

•  $18.6  million  in  fiscal  year  2007  for  renovating  the  existing  command  center  at 
Peterson  Air  Force  Base  to  accommodate  the  functions  being  relocated  from 
Cheyenne  Mountain,  for  additional  study  costs,  and  for  completing  computer 
purchases;  and 

•  $15  million  for  fiscal  year  2008  to  complete  communications  and  systems 
equipment  purchases  and  program  management  support. 

In  addition,  NORAD  and  USNORTHCOM  officials  estimate  that  approximately  $5.5 
million  will  be  needed  annually  to  operate  and  maintain  the  computer  systems  and  to 
provide  help  desk  support  once  the  integrated  command  center  is  operational. 
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There  are  no  short-term  cost  savings  from  relocating  functions  from  Cheyenne 
Mountain.  However,  NORAD  and  USNORTHCOM  officials  stated  that  certain 
transformational  benefits,  such  as  increased  unity  of  effort  and  improved  operational 
efficiencies  and  effectiveness,  are  the  main  reasons  for  integrating  the  command 
centers.  Specifically,  officials  stated  that  having  one  unified  command  center  will 
increase  the  situational  awareness  across  all  NORAD  and  USNORTHCOM  missions 
and  will  provide  a  single  voice  to  decision  makers.  However,  officials  noted  that  they 
have  not  done  an  analysis  of  the  operational  effects — both  positive  and  negative — of 
the  move.  Furthermore,  the  officials  stated  that  they  have  not  thus  far  effectively 
communicated  and  documented  the  anticipated  benefits  and  plan  to  improve 
communications  both  within  the  command  and  with  outside  entities. 

Air  Force  Space  Command  Relocation 

The  projected  cost  for  relocating  the  Space  Control  Center  and  the  Unified  Space 
Vault  from  Cheyenne  Mountain  to  the  Joint  Space  Operations  Center  at  Vandenberg 
Air  Force  Base,  California,  is  approximately  $13  million.  Of  this  amount,  $4.5  million 
was  allocated  in  fiscal  year  2006  for  studies,  renovation  of  facilities,  and  relocation  of 
equipment  to  Vandenberg,  and  $5.4  million  was  allocated  in  fiscal  year  2007  for 
training,  temporary  duty  to  Vandenberg,  and  relocation  of  equipment.  An  additional 
$2.9  million  has  been  requested  to  complete  the  move,  but  at  the  time  of  our  review, 
Air  Force  Space  Command  officials  did  not  know  from  which  fiscal  year  these 
additional  funds  would  be  allocated.  Moreover,  costs  for  any  needed  security 
upgrades  at  Vandenberg  have  not  yet  been  determined,  pending  a  security 
assessment  that  is  scheduled  to  be  completed  in  August  2007.  According  to  Air  Force 
Space  Command  officials,  the  first  phase  of  the  equipment  move  has  been  completed, 
and  the  equipment  is  operating  at  Vandenberg.  The  remaining  equipment  is 
scheduled  to  be  moved  by  October  2007.  Air  Force  Space  Command  officials  expect 
that  the  relocation  will  enable  them  to  reduce  future  costs  for  systems  modernization 
and  maintenance  and  for  contractor  operations.  Moreover,  these  officials  stated  that 
the  space  mission  does  not  require  “hardening”  from  nuclear  attack  and  does  not 
have  to  be  located  in  Cheyenne  Mountain. 

U.S.  Strategic  Command  Relocation 

The  costs  to  relocate  the  missile  warning  mission  from  Cheyenne  Mountain  to 
Schriever  Air  Force  Base,  Colorado,  have  not  yet  been  developed.  According  to 
USSTRATCOM  officials,  an  ongoing  site  survey  scheduled  for  completion  in  late  May 
2007  will  determine  the  security  requirements,  and  a  subsequent  engineering  study 
will  develop  the  estimated  costs  of  the  planned  relocation.  USSTRATCOM  decided  to 
move  its  missile  warning  mission  to  get  away  from  the  mountain’s  legacy  computer 
systems  and  acquire  a  more  modern  net-centric  system  using  distributed  nodes. 

Security  Implications  and  Associated  Risks  of  the 
Proposed  Relocation  Have  Not  Been  Fully  Determined 

After  reviewing  initial  risk  and  vulnerability  assessments  conducted  by 
USNORTHCOM  in  early  2006,  the  Commander  accepted  the  risk  of  integrating  the 
two  command  centers,  but  the  full  security  implications  and  the  associated  risks  of 
the  proposed  relocation  will  not  be  known  until  at  least  September  2007,  following 
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the  completion  of  ongoing  security  assessments  and  the  designation  of  a  protection 
level  for  the  new  command  center.  An  electromagnetic  pulse  hardening  assessment, 
a  physical  security  assessment  of  the  NORAD  and  USNORTHCOM  headquarters 
building,  and  the  designation  of  a  protection  level  for  the  new  command  center  are  in 
progress.  If  the  protection  level  designation  requirements  cannot  be  met  for 
replicating  the  desired  systems  due  to  resource  or  funding  constraints,  waivers  will 
be  needed  to  proceed  with  the  planned  integration  or  specific  systems  may  remain  in 
Cheyenne  Mountain. 

Initial  Security  Assessments 

In  January  2006,  USNORTHCOM  conducted  a  classified  risk  assessment14  on  the 
NORAD  and  USNORTHCOM  headquarters  building  at  Peterson  Air  Force  Base.  As  a 
result  of  this  risk  analysis,  NORAD  and  USNORTHCOM  have  taken  some  steps  to 
mitigate  known  vulnerabilities  to  the  headquarters  building  from  potential  threats, 
which  exist  regardless  of  the  command  center  integration.  For  example,  NORAD  and 
USNORTHCOM  have  limited  the  access  to  backup  generators  and  the  garage  of  the 
headquarters  building.  Additionally,  in  March  2006,  USNORTHCOM  conducted  a 
classified  risk  assessment10  that  compared  the  vulnerability  of  the  Cheyenne 
Mountain  Operations  Center  to  the  NORAD  and  USNORTHCOM  headquarters 
building.  After  seeing  these  initial  security  assessments  based  on  current  and 
projected  threats,  the  NORAD  and  USNORTHCOM  Commander  deemed  that  the  risk 
incurred  by  integrating  the  two  command  centers  was  acceptable. 

USNORTHCOM  also  contracted  with  Sandia  National  Laboratories  to  determine  the 
security  implications  of  moving  assigned  missions  to  Peterson  Air  Force  Base. 
Sandia’s  December  2006  classified  report16  analyzed  four  different  options  for  moving 
the  missions.  Sandia’s  report  recommended  replicating  some  of  the  computer 
systems  in  Cheyenne  Mountain  because  this  solution  would  require  a  lower 
protection  level  than  moving  all  computer  systems  and  would  cost  less.  However,  a 
USNORTHCOM  official  told  us  that  the  Commander  is  still  considering  other  options 
and  additional  security  assessments  are  ongoing. 

Ongoing  Security  Assessments 

Two  security  assessments  related  to  moving  functions  from  Cheyenne  Mountain  to 
Peterson  Air  Force  Base  are  underway.  First,  Sandia  National  Laboratories  is 
assessing  the  cost  associated  with  hardening  computer  terminals  used  to  track  air, 
missile,  and  space  events,  and  examining  the  methods  needed  to  protect  those 
terminals  against  man-made  and  natural  threats.  The  results  of  this  assessment, 
which  is  scheduled  to  be  completed  in  May  2007,  will  enable  the  NORAD  and 
USNORTHCOM  Commander  to  assess  the  feasibility  of  moving  these  terminals. 
Second,  according  to  an  Air  Force  Space  Command  official,  the  Air  Force  is 
conducting  a  Systems  Effectiveness  Assessment  that  will  determine  the  effectiveness 


14U.S.  Northern  Command,  Risk  Assessment  Report  (Peterson  Air  Force  Base,  Colo.:  January  2006). 
15U.S.  Northern  Command,  Cheyenne  Mountain  Operations  Center/Building  2  Vulnerability 
Assessment  against  Terrorist  Attacks  (Peterson  Air  Force  Base,  Colo.:  March  2006). 
lbSandia  National  Laboratories,  Phase  2:  Security  Assessment  Results  and  Conceptual  Security 
Designs  for  North  American  Aerospace  Defense  Command  and  United  States  Northern,  Command, 
(Albuquerque,  N.Mex.:  December  2006). 
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of  the  security  system  at  NORAD  and  USNORTHCOM  headquarters  to  detect,  delay, 
deny,  and  neutralize  a  threat;  however,  the  assessment  will  not  specifically  examine 
procedures  for  protecting  against  a  chemical/biological  attack.  After  the  completion 
of  this  assessment,  the  leadership  will  be  able  to  develop  an  actionable  plan  with  cost 
estimates  to  build  a  system  to  protect  the  building  at  those  levels  through  the 
conceptual  design  process.  USNORTHCOM  officials  expect  the  results  of  this 
assessment  in  September  2007. 

According  to  a  USNORTHCOM  official,  a  complete  protection  level  study  has  never 
been  conducted  on  the  NORAD  and  USNORTHCOM  headquarters  building. 
USNORTHCOM  is  in  the  process  of  completing  a  Protection  Level  Designation  Matrix 
that  includes  information  on  the  threat  to  the  headquarters  building  and  its 
significance  to  the  United  States’  warfighting  capability.  This  tool  will  help  the 
Department  of  the  Air  Force  determine  a  protection  level  for  the  building.  An  Air 
Force  Space  Command  official  said  that  if  NORAD  and  USNORTHCOM  cannot  meet 
the  protection  level  requirements  for  the  integrated  command  center  due  to  resource 
or  funding  constraints,  they  will  have  to  request  waivers  and  develop  a  mitigation 
strategy.  He  added  that  it  could  take  up  to  24  months  to  get  the  completed  security 
system  in  place  if  it  was  fully  funded. 

According  to  the  Deputy  Director  of  Operations  of  the  NORAD  and  USNORTHCOM 
Command  Center,  the  renovation  of  the  command  center  is  not  dependent  upon  the 
decision  regarding  the  appropriate  protection  level.  This  official  stated  the 
protection  level  requirements  are  focused  on  external  vulnerabilities  and  address 
issues  such  as  cameras,  bollards  for  stand-off  distances,  and  additional  security 
forces  personnel.  Nonetheless,  one  component  of  the  renovation  will  depend  on  the 
results  of  the  ongoing  electromagnetic  pulse  hardening  assessment,  but  this  will 
affect  only  two  of  the  many  systems  in  the  command  centers.  The  Deputy  Director  of 
Operations  stated  that  he  does  not  anticipate  having  to  delay  the  renovation  to  await 
any  report  results  but  will  incorporate  all  accepted  recommendations  into  the 
renovation  of  the  integrated  command  center.  He  said  that  the  contractor  has  been 
given  the  authority  to  proceed  with  renovation  on  June  11,  2007.  It  is  scheduled  for 
completion  in  December  2007. 

Conclusions 

The  proposed  realignment  of  functions  from  Cheyenne  Mountain  represents  a  major 
transformation  for  NORAD  and  USNORTHCOM.  Without  benefit  of  an  analysis  of 
operational  effects  of  the  proposed  moves,  the  completed  security  assessments,  and 
final  protection  level  designation  to  inform  him,  it  is  unclear  what  level  of  risk  the 
Commander  is  accepting  in  integrating  the  two  command  centers.  Furthermore,  the 
costs  associated  with  any  needed  security  upgrades  are  not  known  and  it  is  unclear 
whether  resources  and  funding  are  available  to  meet  the  protection  level 
requirements.  Without  knowing  the  complete  security  effects  and  cost  to  replicate 
the  functions,  neither  DOD  nor  Congress  has  adequate  information  to  assess  the  risks 
in  relation  to  the  costs  of  moving  functions  from  Cheyenne  Mountain. 
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Matters  for  Congressional  Consideration 

GAO  is  not  making  any  recommendations  for  executive  action.  However,  Congress 
should  consider  restricting  DOD’s  authority  to  use  funds  to  renovate  new  locations  to 
accept  functions  designated  to  move  out  of  Cheyenne  Mountain  until  such  time  as  all 
security  analyses  are  complete,  the  full  costs  of  the  move  are  determined,  and  DOD 
provides  Congress  with  an  analysis  of  the  operational  effects  of  the  proposed 
realignments. 

Agency  Comments 

We  received  technical  comments  from  DOD,  which  we  incorporated  as  appropriate. 
In  their  technical  comments,  NORAD  and  USNORTHCOM  noted  that  the  new 
commander  clarified  that  the  relocation  was  initiated  by  mission  inefficiencies,  not 
cost  savings,  and  is  required  to  increase  unity  of  effort  and  operational  effectiveness. 
Further,  USNORTHCOM  noted  that  the  synergies  gained  through  consolidation  of 
missions  into  a  single  command  center  are  essential  for  an  effective  response  to  the 
full  spectrum  of  threats  to  the  United  States.  Nevertheless,  our  review  showed  that 
NORAD  and  USNORTHCOM  did  not  fully  analyze  the  costs  and  operational  effects  of 
the  proposed  move,  and,  therefore,  we  are  including  a  matter  for  congressional 
consideration. 

We  are  sending  copies  of  this  report  to  the  Secretary  of  Defense;  the  Chairman,  Joint 
Chiefs  of  Staff;  the  Secretary  of  the  Air  Force;  and  the  Commanders  of  NORAD  and 
USNORTHCOM  and  USSTRATCOM.  We  will  make  copies  available  to  others  upon 
request.  This  report  will  be  available  at  no  charge  on  GAO’s  Web  site  at 
http://www.  gao.  gov. 

If  you  or  your  staff  have  any  questions  about  this  report,  please  contact  me  at  (202) 
512-5431  or  dagostinod@gao.  gov.  Contact  points  for  our  Office  of  Congressional 
Relations  and  Public  Affairs  may  be  found  on  the  last  page  of  this  report.  Key 
contributors  to  this  report  were  Mike  Kennedy,  Assistant  Director;  Amy  Higgins; 

Keith  Rhodes;  Enemencio  Sanchez;  Kimberly  Seay;  Brian  Shiels;  Karen  Thornton;  and 
Cheryl  Weissman. 


Davi  M.  D’Agostino 

Director,  Defense  Capabilities  and  Management 
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This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the 
United  States.  It  may  be  reproduced  and  distributed  in  its  entirety  without  further 
permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or 
other  material,  permission  from  the  copyright  holder  may  be  necessary  if  you  wish  to 
reproduce  this  material  separately. 
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